Path Traversal
Monthly
Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in the file parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in file in Enigma2 Webinterface 1.5rc1 and 1.5beta4 allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 22.9%.
Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
HP StorageWorks P2000 G3 MSA array systems have a default account, which makes it easier for remote attackers to perform administrative tasks via unspecified vectors, a different vulnerability than. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
libgit2, as packaged in Alpine Linux, received a security fix in version 1.9.6-r0. The specific vulnerability class, impact, and affected upstream libgit2 release are not disclosed in the available intelligence - only the Alpine package fix version is confirmed. No public exploit has been identified at time of analysis, and CISA KEV status is absent from the data.
Alpine Linux: buildah fixed in 1.37.5-r0
ImageMagick on Alpine Linux has been patched in package version 7.1.2.24-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The nature, impact class, and exploitability of the underlying flaw are not described in the available CVE data - no CVSS score, CWE classification, or vulnerability description has been published at time of analysis. Security teams should treat this as a forced-upgrade situation and apply the Alpine package update, but cannot currently assess severity or attacker prerequisites from public data alone. No public exploit identified at time of analysis; not listed in CISA KEV.
Podman on Alpine Linux has been patched in package version 5.8.3-r0 to address CVE-2026-44517. No vulnerability description, CVSS score, CWE classification, KEV status, EPSS score, or technical detail is available from the provided intelligence. The nature of the flaw, its impact on confidentiality, integrity, or availability, and its exploitability cannot be characterized from current data.
Grafana packaged for Alpine Linux contains an unspecified vulnerability addressed in Alpine package version 12.4.4-r0. The upstream Grafana version corresponding to the fix is 12.4.4. The nature of the vulnerability, its impact category, affected version range, and exploitation conditions are not disclosed in the available intelligence. No public exploit identified at time of analysis.
Cacti network monitoring software received a security fix packaged as version 1.2.31-0 in Alpine Linux, addressing CVE-2026-40084. The upstream vulnerability details - including attack vector, root cause, and impact - are not disclosed in available intelligence sources. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Cacti, the network monitoring and graphing tool packaged for Alpine Linux, was patched at version 1.2.31-0 to address CVE-2026-39899. The nature, class, and severity of the underlying vulnerability are not disclosed in available data - no description, CWE, or CVSS vector was provided. No public exploit and no CISA KEV listing have been identified at time of analysis.
Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in the file parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in file in Enigma2 Webinterface 1.5rc1 and 1.5beta4 allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 22.9%.
Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
HP StorageWorks P2000 G3 MSA array systems have a default account, which makes it easier for remote attackers to perform administrative tasks via unspecified vectors, a different vulnerability than. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
libgit2, as packaged in Alpine Linux, received a security fix in version 1.9.6-r0. The specific vulnerability class, impact, and affected upstream libgit2 release are not disclosed in the available intelligence - only the Alpine package fix version is confirmed. No public exploit has been identified at time of analysis, and CISA KEV status is absent from the data.
Alpine Linux: buildah fixed in 1.37.5-r0
ImageMagick on Alpine Linux has been patched in package version 7.1.2.24-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The nature, impact class, and exploitability of the underlying flaw are not described in the available CVE data - no CVSS score, CWE classification, or vulnerability description has been published at time of analysis. Security teams should treat this as a forced-upgrade situation and apply the Alpine package update, but cannot currently assess severity or attacker prerequisites from public data alone. No public exploit identified at time of analysis; not listed in CISA KEV.
Podman on Alpine Linux has been patched in package version 5.8.3-r0 to address CVE-2026-44517. No vulnerability description, CVSS score, CWE classification, KEV status, EPSS score, or technical detail is available from the provided intelligence. The nature of the flaw, its impact on confidentiality, integrity, or availability, and its exploitability cannot be characterized from current data.
Grafana packaged for Alpine Linux contains an unspecified vulnerability addressed in Alpine package version 12.4.4-r0. The upstream Grafana version corresponding to the fix is 12.4.4. The nature of the vulnerability, its impact category, affected version range, and exploitation conditions are not disclosed in the available intelligence. No public exploit identified at time of analysis.
Cacti network monitoring software received a security fix packaged as version 1.2.31-0 in Alpine Linux, addressing CVE-2026-40084. The upstream vulnerability details - including attack vector, root cause, and impact - are not disclosed in available intelligence sources. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Cacti, the network monitoring and graphing tool packaged for Alpine Linux, was patched at version 1.2.31-0 to address CVE-2026-39899. The nature, class, and severity of the underlying vulnerability are not disclosed in available data - no description, CWE, or CVSS vector was provided. No public exploit and no CISA KEV listing have been identified at time of analysis.